1. Field of the Invention
The present invention relates generally to the field of certification and accreditation (C&A) and, more particularly, to a computer-implemented system method and medium for C&A that enables users to tailor a sequence of requirements and/or activities that can be used to assess the risk of and/or determine the suitability of a target system to comply with at least one predefined standard, regulation and/or requirement.
2. Background Description
The general purpose of C&A is to certify that automated information systems, for example, adequately protect information in accordance with data sensitivity and/or classification levels. In accordance with Department of Defense (DoD) Instruction 5200.40, dated Dec. 30, 1997, entitled DoD Information Technology Security Certification and Accreditation Process (DITSCAP), which is incorporated herein by reference in its entirety, certification can, for example, be defined as the comprehensive evaluation of the technical and non-technical features of an information technology (IT) system and other safeguards, made in support of the accreditation process, to establish the extent that a particular design and implementation meets a set of specified security requirements. Similarly, as used herein, accreditation can be defined as a formal declaration by a designated approving authority that an IT system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In general, DISTSCAP is utilized by the DoD for identifying and documenting threats and vulnerabilities that pose risk to critical information systems. DITSCAP compliance generally means that security risk posture is considered acceptable and that potential liability for system “owners” is mitigated. As used herein, a threat can be considered any circumstance or event with the potential to cause harm to an information technology system in the form of, for example, destruction, disclosure, adverse modification of data, and/or denial of service. As used herein, a vulnerability can be considered a weakness in, for example, an information system, or cryptographic system, or components (e.g., system security procedures, hardware design, internal controls) thereof that could be exploited.
The C&A process typically involves a number of policies, regulations, guidelines, best practices, etc. that serve as C&A criteria. Conventionally, the C&A process is typically a labor intensive exercise that can require multiple skill sets over a period of time typically spanning 6-12 months. There can be, for example, several organizations and/or individuals that may be involved in the processes of selecting applicable standards, regulations and/or test procedures, and assembling test results and other information into a DITSCAP compliant package. There is therefore a need to substantially streamline and expedite the security C&A process in a manner that utilizes a robust risk assessment model, and substantially automates and enables a user to tailor a sequence of events that can be used, for example, to perform security risk assessments, certification test procedure development, system configuration guidance, and residual risk acceptance.